The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python script (scripts/add_provider.py) and documentation for using curl to interact with the Bolna API. The script is a legitimate utility for registering provider keys.
[DATA_EXFILTRATION]: The skill transmits provider credentials to the vendor's official API at api.bolna.ai. This is the intended and documented purpose of the skill, representing normal vendor functionality for managing user-provided credentials.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect injection as it processes user-supplied credentials. Ingestion points: CLI arguments --value and --value-env in scripts/add_provider.py. Boundary markers: The script uses structured JSON for API requests, which provides data separation. Capability inventory: Performs network POST requests using urllib.request.urlopen. Sanitization: No explicit sanitization of credential values is performed prior to transmission, though the data is handled as a structured JSON value.

add-provider